c770093587db0c4503dd8acaeaf9e1021ab8a19473640b4011525f397c8a99a6

Resubmissions

31/10/2023, 19:59

231031-yqxbrafd25 10

31/10/2023, 19:56

231031-yn5v4sdb9v 5

Analysis

max time kernel
71s
max time network
83s
platform
windows10-2004_x64
resource
win10v2004-20231023-es
resource tags

arch:x64arch:x86image:win10v2004-20231023-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
31/10/2023, 19:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

09 NOTIFICACION DEMANDA JUDICIAL/09 NOTIFICACION DEMANDA JUDICIAL....exe
Size

658KB
MD5

ab63396cb0774ac41107b7b112f81d5a
SHA1

f5dc67429147e886b01413472496576a2ee34075
SHA256

9a43c57f3e98bd69789e8ccbeef2c1b6b5a3b1d06d63257bb4bd58dffa23689d
SHA512

2121961ae2b154ba941af6937d0522505ec7e323094fb2edc7058194ae958bcf866bbbc7842924236b8635917800d0708eaabff6112f131f496189bb6e021699
SSDEEP

12288:BKwp3N7HPqUeL31VI1kR8BgrsEofzwHJem7OzwHJe0IhfiZ:swp97HyUeLFVIuRCgrsEorwpemIwpels

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4628 set thread context of 3816	4628	09 NOTIFICACION DEMANDA JUDICIAL....exe	86

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4628	09 NOTIFICACION DEMANDA JUDICIAL....exe
3816	cmd.exe
3816	cmd.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4628	09 NOTIFICACION DEMANDA JUDICIAL....exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4628 wrote to memory of 3816	4628	09 NOTIFICACION DEMANDA JUDICIAL....exe	86
PID 4628 wrote to memory of 3816	4628	09 NOTIFICACION DEMANDA JUDICIAL....exe	86
PID 4628 wrote to memory of 3816	4628	09 NOTIFICACION DEMANDA JUDICIAL....exe	86
PID 4628 wrote to memory of 3816	4628	09 NOTIFICACION DEMANDA JUDICIAL....exe	86

C:\Users\Admin\AppData\Local\Temp\09 NOTIFICACION DEMANDA JUDICIAL\09 NOTIFICACION DEMANDA JUDICIAL....exe
"C:\Users\Admin\AppData\Local\Temp\09 NOTIFICACION DEMANDA JUDICIAL\09 NOTIFICACION DEMANDA JUDICIAL....exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4628
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\SysWOW64\cmd.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1b3cdeaf

Filesize
638KB

MD5
b95a4bc8413e95fb7dd4a955ff3b7504

SHA1
2434f2abcb19fca1e2b78797292b4e16c90677e1

SHA256
78d758e26816c61987aa7997fd64634dc27f7680df148353d89e302ce1287784

SHA512
2c627d68834f42dd4a58bb6187c4e2666fce6934f564a62d332166c5f349ba00b3f7fcc57f3d1c58616e5e78172a0c09b827af8bc07fc7a20f56a1ad78d4766b

Download Submit
memory/3816-33-0x00007FFB1A2B0000-0x00007FFB1A4A5000-memory.dmp

Filesize
2.0MB

Download
memory/4628-0-0x00007FFB0B700000-0x00007FFB0B872000-memory.dmp

Filesize
1.4MB

Download
memory/4628-29-0x00007FFB0B700000-0x00007FFB0B872000-memory.dmp

Filesize
1.4MB

Download
memory/4628-30-0x00007FFB0B700000-0x00007FFB0B872000-memory.dmp

Filesize
1.4MB

Download